Analysis
-
max time kernel
159s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09-03-2023 01:46
Static task
static1
Behavioral task
behavioral1
Sample
bf35c2910d407f1cf330f465a793dc1b.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
bf35c2910d407f1cf330f465a793dc1b.exe
Resource
win10v2004-20230220-en
General
-
Target
bf35c2910d407f1cf330f465a793dc1b.exe
-
Size
2.1MB
-
MD5
bf35c2910d407f1cf330f465a793dc1b
-
SHA1
306324e8b2cc82f09c7b0f56cde008337b8f5205
-
SHA256
bc0374c212e401d5f220df5657a980fc40fc210af0a7c34dd8d43556d8b2a4be
-
SHA512
6fb5fa5ab36acbcf9726426b31ec843b3f8d277047e8d1d51136a91628dd3e0d2c99e6809578ab83f0cc5bb67706462b5653ce00943c7b168d010ce7faab9094
-
SSDEEP
49152:UrpxN1w5b1QvE4mnVA93py1abMy+mUIuEMyN5KvG8aM6TyHIzkY:Ijw5K4A93paabwtIuEMyN2G8fRY
Malware Config
Extracted
bitrat
1.38
pradeepprabhu705.hopto.org:312
-
communication_password
827ccb0eea8a706c4c34a16891f84e7b
-
tor_process
tor
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
bf35c2910d407f1cf330f465a793dc1b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\BmUXYeTbHs5V2xGl\\0YufzxZVaDdk.exe\",explorer.exe" bf35c2910d407f1cf330f465a793dc1b.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
bf35c2910d407f1cf330f465a793dc1b.exepid process 3644 bf35c2910d407f1cf330f465a793dc1b.exe 3644 bf35c2910d407f1cf330f465a793dc1b.exe 3644 bf35c2910d407f1cf330f465a793dc1b.exe 3644 bf35c2910d407f1cf330f465a793dc1b.exe 3644 bf35c2910d407f1cf330f465a793dc1b.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
bf35c2910d407f1cf330f465a793dc1b.exedescription pid process Token: SeDebugPrivilege 3644 bf35c2910d407f1cf330f465a793dc1b.exe Token: SeDebugPrivilege 3644 bf35c2910d407f1cf330f465a793dc1b.exe Token: SeShutdownPrivilege 3644 bf35c2910d407f1cf330f465a793dc1b.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
bf35c2910d407f1cf330f465a793dc1b.exepid process 3644 bf35c2910d407f1cf330f465a793dc1b.exe 3644 bf35c2910d407f1cf330f465a793dc1b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf35c2910d407f1cf330f465a793dc1b.exe"C:\Users\Admin\AppData\Local\Temp\bf35c2910d407f1cf330f465a793dc1b.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3644-133-0x0000000001270000-0x0000000001280000-memory.dmpFilesize
64KB
-
memory/3644-134-0x0000000001270000-0x0000000001280000-memory.dmpFilesize
64KB
-
memory/3644-137-0x000000007F290000-0x000000007F291000-memory.dmpFilesize
4KB
-
memory/3644-138-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-140-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-141-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-142-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-143-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-144-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-145-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-146-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-147-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-148-0x0000000072510000-0x0000000072549000-memory.dmpFilesize
228KB
-
memory/3644-149-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-150-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-151-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-152-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-153-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-157-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-161-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-165-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-169-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-173-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-177-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-181-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-185-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-189-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-193-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB
-
memory/3644-197-0x000000007EEC0000-0x000000007F28E000-memory.dmpFilesize
3.8MB